Apollo - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/apollo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 03 Aug 2026 18:11:02 +0000Critical Prototype Pollution Vulnerability in Apollo Federationhttps://feed.craftedsignal.io/briefs/2026-08-apollo-prototype-pollution/Mon, 03 Aug 2026 18:11:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-apollo-prototype-pollution/CVE-2026-32621 is a critical prototype pollution vulnerability in Apollo Federation that allows unauthenticated attackers to manipulate application objects via malicious GraphQL queries.CVE-2026-32621 is a critical prototype pollution vulnerability (CWE-1321) affecting Apollo Federation gateways. The vulnerability resides in the deepMerge process, where an attacker can supply specially crafted GraphQL queries containing recursive keys such as proto, constructor, or prototype within field aliases or variable names. By exploiting this, an attacker can modify the base Object.prototype, causing subsequent requests to inherit malicious properties. This can lead to privilege escalation, unauthorized data access, or denial of service depending on the application context. The vulnerability has been assigned a CVSS score of 9.9, and working exploit code has been publicly released, significantly increasing the risk of exploitation for unpatched instances. Organizations using Apollo Federation should prioritize patching to the provided versions immediately.

Attack Chain

  1. Attacker crafts a GraphQL query containing object prototype keys like proto or constructor inside a field alias.
  2. Attacker sends the malicious GraphQL query to the Apollo Gateway endpoint (e.g., /graphql) via a standard HTTP POST request.
  3. The Apollo Gateway receives the query and initiates the processing flow, forwarding the request to the relevant subgraph.
  4. The subgraph returns a JSON response containing the malicious prototype keys.
  5. The Apollo Gateway invokes its deepMerge() utility function to combine the response data.
  6. The deepMerge() function incorrectly processes the prototype keys, resulting in the injection of properties directly into the global Object.prototype.
  7. All subsequent operations handled by the gateway inherit the polluted properties from Object.prototype.
  8. Attacker leverages these injected properties (e.g., isAdmin: true) to bypass authentication or execute arbitrary application logic.

Impact

Successful exploitation allows attackers to alter the application state globally, potentially leading to full compromise of the gateway's security controls. Any downstream application relying on the object's integrity is affected. Public availability of an exploit increases the likelihood of widespread automated scanning and exploitation attempts against internet-facing GraphQL endpoints.

Recommendation

  1. Upgrade all Apollo Federation instances to versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, or 2.13.2 immediately.
  2. Implement request filtering at the Web Application Firewall (WAF) or API gateway layer to block GraphQL queries containing keys: proto, constructor, or prototype.
  3. Review GraphQL schemas and validation logic to ensure strict adherence to allowed field aliases and variables.
  4. Use Object.create(null) for data structures intended to hold external, untrusted input to prevent prototype inheritance.
]]>criticaladvisory